CVE-2026-40194 | phpseclib up to 1.0.27/2.0.52/3.0.50 SSH2::get_binary_packet timing discrepancy (GHSA-r854-jrxh-36qx)

A vulnerability classified as problematic was found in phpseclib up to 1.0.27/2.0.52/3.0.50. Impacted is the function SSH2::get_binary_packet. Executing a manipulation can lead to observable timing discrepancy.

The identification of this vulnerability is CVE-2026-40194. The attack may be launched remotely. There is no exploit available.

Upgrading the affected component is advised.